docker: publish lean image as :core and full image as :studio

Complete the base->core (and "studio as studio") tag rename so the publish
workflow matches the user-facing helpers and the Dockerfile.studio header.

- The lean training image now publishes as :core (core-<tag>, core-nightly,
  core-sha-*); run.sh / docker_confirm.* already told users to pull :core, but
  docker-publish.yml still tagged it :base, so that pull would have 404'd. The
  per-arch digest artifacts are renamed to match.
- The full Studio image keeps :latest and gains a stable :studio alias, matching
  the Dockerfile.studio header.

Both the merge and post-publish smoke-test metadata blocks are updated together.
Internal "base image" wording (the layer Studio builds FROM) is left as-is.

.github/workflows/docker-publish.yml

@@ -181,7 +181,7 @@ jobs:
       - name: Upload digest
         uses: actions/upload-artifact@v4
         with:
-          name: digests-base-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          name: digests-core-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -208,7 +208,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
-          pattern: digests-base-*
+          pattern: digests-core-*
           merge-multiple: true
 
       - uses: docker/setup-buildx-action@v3
@@ -225,17 +225,17 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            # The lean training image publishes under the base- prefix; the
+            # The lean training image publishes under the core- prefix; the
             # full Studio image (build-studio/merge-studio below) owns
             # :latest, matching what the previous production image shipped.
-            # Only tag :base when the workflow ran on the default branch
+            # Only tag :core when the workflow ran on the default branch
             # AND the operator did NOT override unsloth_ref on dispatch.
             # Without the second condition a maintainer testing a feature
-            # SHA from main could overwrite :base with non-main source.
-            type=raw,value=base,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
-            type=ref,event=tag,prefix=base-
-            type=schedule,pattern=base-nightly
-            type=sha,prefix=base-sha-,format=short
+            # SHA from main could overwrite :core with non-main source.
+            type=raw,value=core,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
+            type=ref,event=tag,prefix=core-
+            type=schedule,pattern=core-nightly
+            type=sha,prefix=core-sha-,format=short
 
       - name: Create multi-arch manifest
         working-directory: /tmp/digests
@@ -380,8 +380,10 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             # The full Studio image owns the unprefixed namespace, headed by
-            # :latest. Same :latest gating rationale as the base job.
+            # :latest, with a stable :studio alias. Same gating rationale as
+            # the core job.
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
+            type=raw,value=studio,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
             type=ref,event=tag
             type=schedule,pattern=nightly
             type=sha,prefix=sha-,format=short
@@ -429,19 +431,19 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=raw,value=base,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
-            type=ref,event=tag,prefix=base-
-            type=schedule,pattern=base-nightly
-            type=sha,prefix=base-sha-,format=short
+            type=raw,value=core,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
+            type=ref,event=tag,prefix=core-
+            type=schedule,pattern=core-nightly
+            type=sha,prefix=core-sha-,format=short
 
       - name: Pull and smoke-test the base image
         run: |
           # Use the first tag from the metadata output -- that is the image we
-          # just published. Falls back to :base only when the metadata is
+          # just published. Falls back to :core only when the metadata is
           # empty (defensive; should not happen on default-branch runs).
           TAG="$(jq -r '.tags[0] // ""' <<<"$STEPS_META_BASE_JSON")"
           if [ -z "$TAG" ]; then
-              TAG="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:base"
+              TAG="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:core"
           fi
           echo "smoke-testing $TAG"
           docker pull "$TAG"
@@ -456,6 +458,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
+            type=raw,value=studio,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
             type=ref,event=tag
             type=schedule,pattern=nightly
             type=sha,prefix=sha-,format=short